CTM360_HackerView

Details

ID	`CTM360_HackerView`
Provider	CTM360
Category	Network Security
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

External Attack Surface Management platform, which combines automated asset discovery, issue identification / management, remediation guidelines, security ratings and third party risk management.

Use Module To Use to select which HackerView data source this instance fetches:

Light Scan — external attack surface findings from the standard HackerView light scan module.
Deep Scan — deeper vulnerability and exposure findings from the HackerView Deep Scan module, including additional fields such as CVSS, evidence, and asset context.

This integration was integrated and tested with version 1.0.0 of CTM360_HackerView.

Configure CTM360 HackerView in Cortex

Parameter	Description	Required
Incident Mirroring Direction	Choose the direction to mirror the incident: Incoming (from HackerView to Cortex XSOAR), Outgoing (from Cortex XSOAR to HackerView), or Incoming and Outgoing (from/to Cortex XSOAR and HackerView).	False
Module To Use	The module to use: Light Scan or Deep Scan.	False
First fetch (<number> <time unit>, e.g., 12 hours)	The time the incidents should be fetched starting from.	False
API Key	The CTM360 HackerView API Key to use for fetching data.	True
Maximum Number of Incidents per Fetch	The maximum number of incidents to fetch per run. Maximum is 200.	True
Fetch incidents		False
Trust any certificate (not secure)		False
Use system proxy settings		False
Incident type		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ctm360-hv-incident-list

Get the list of incidents from HV.

Base Command

ctm360-hv-incident-list

Input

Argument Name	Description	Required
dateFrom	Select “From” date to fetch incidents starting from it.	Optional
dateTo	Select “To” date to fetch incidents up to it.	Optional
maxHits	Set number of results to fetch.	Optional
order	Set the order of the results.	Optional

Context Output

Path	Type	Description
HackerView.IncidentList	unknown	List of all HV incidents.

ctm360-hv-incident-status-change

Change status of a HV incident and optionally add a comment.

Base Command

ctm360-hv-incident-status-change

Input

Argument Name	Description	Required
ticketId	“ID” of the incident to change status.	Required
ticketStatus	New “Status” of incident.	Required
comment	“Comment” to accompany the status change (Optional).	Optional

Context Output

There is no context output for this command.

get-mapping-fields

Returns the list of fields for an incident type.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

ctm360-hv-incident-details

Fetch details of a single incident from the HackerView platform.

Base Command

ctm360-hv-incident-details

Input

Argument Name	Description	Required
ticketId	“Ticket ID” of the incident to fetch.	Required

Context Output

Path	Type	Description
HackerView.RemoteIncident.id	unknown	The symbolic incident ID.
HackerView.RemoteIncident.timestamp	unknown	The database timestamp.
HackerView.RemoteIncident.confidence	unknown	The confidence of the report.
HackerView.RemoteIncident.cve_id	unknown	The associated CVE identifier(s).
HackerView.RemoteIncident.cwe	unknown	The list of associated CWEs.
HackerView.RemoteIncident.issue_category	unknown	The category of the incident.
HackerView.RemoteIncident.issue_name	unknown	The name of the incident.
HackerView.RemoteIncident.potential_attack_type	unknown	The potential attack type that can make use of the incident.
HackerView.RemoteIncident.potential_impact	unknown	The potential impact of the incident.
HackerView.RemoteIncident.status	unknown	The active status of the incident.
HackerView.RemoteIncident.progress_status	unknown	The progress of incident response.
HackerView.RemoteIncident.severity	unknown	The severity of the incident.
HackerView.RemoteIncident.resolved_ip	unknown	The IP resolved on the affected asset.
HackerView.RemoteIncident.first_seen	unknown	The incident creation date.
HackerView.RemoteIncident.last_seen	unknown	The last discovery date for the incident.
HackerView.RemoteIncident.last_updated	unknown	The last update date for the incident.
HackerView.RemoteIncident.environments	unknown	The environments associated with the incident.
HackerView.RemoteIncident.ticket_id	unknown	The ticket ID.
HackerView.RemoteIncident.technologies	unknown	The technologies on the affected asset.
HackerView.RemoteIncident.domain	unknown	The domain of the affected asset.
HackerView.RemoteIncident.host	unknown	The host of the affected asset.
HackerView.RemoteIncident.asset_type	unknown	The affected asset type.
HackerView.RemoteIncident.asset	unknown	The affected asset.
HackerView.RemoteIncident.brand	unknown	The organization brand the incident belongs to.
HackerView.RemoteIncident.ip	unknown	The IP address associated with the finding.
HackerView.RemoteIncident.port	unknown	The network port associated with the finding.
HackerView.RemoteIncident.uri	unknown	The URI path or resource related to the finding.
HackerView.RemoteIncident.url	unknown	The base URL of the affected asset or service.
HackerView.RemoteIncident.issue_type	unknown	The type or classification of the issue.
HackerView.RemoteIncident.issue_description	unknown	The detailed description of the issue.
HackerView.RemoteIncident.cpe	unknown	The Common Platform Enumeration (CPE) identifier if applicable.
HackerView.RemoteIncident.cvss_metrics	unknown	The CVSS vector or metric string for the vulnerability.
HackerView.RemoteIncident.cvss_score	unknown	The CVSS base score for the vulnerability.
HackerView.RemoteIncident.epss_score	unknown	The Exploit Prediction Scoring System (EPSS) score.
HackerView.RemoteIncident.known_exploited	unknown	The indicator of whether the vulnerability is known to be exploited.
HackerView.RemoteIncident.hackerview_link	unknown	The link to the issue in the HackerView platform.
HackerView.RemoteIncident.evidence	unknown	The request/response evidence for the finding (e.g. request, response, curl_command).

get-remote-data

Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.

Base Command

get-remote-data

Input

Argument Name	Description	Required
id	The incident ID.	Required
lastUpdate	Retrieves entries that were created after lastUpdate.	Required

Context Output

There is no context output for this command.

get-modified-remote-data

Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.

Base Command

get-modified-remote-data

Input

Argument Name	Description	Required
lastUpdate	A date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time.	Required

Context Output

There is no context output for this command.

update-remote-system

Updates the remote system with local changes.

Base Command

update-remote-system

Input

Argument Name	Description	Required
remoteId	Remote ID of incident to update in the remote system.	Required

Context Output

There is no context output for this command.

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and CTM360 HackerView corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

Enable Fetching incidents in your instance configuration.

In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

Option	Description
None	Turns off incident mirroring.
Incoming	Any changes in CTM360 HackerView events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
Outgoing	Any changes in Cortex XSOAR incidents will be reflected in CTM360 HackerView events (outgoing mirrored fields).
Incoming And Outgoing	Changes in Cortex XSOAR incidents and CTM360 HackerView events will be reflected in both directions.

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and CTM360 HackerView.

Configuration parameters

mirror_direction — Incident Mirroring Direction
module_to_use — Module To Use
first_fetch — First fetch (<number> <time unit>, e.g., 12 hours)
api_key — (required)
max_fetch — Maximum Number of Incidents per Fetch (required)
isFetch — Fetch incidents
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
incidentFetchInterval — Incidents Fetch Interval

Commands (7)

ctm360-hv-incident-details
Fetch details of a single incident from the HackerView platform.
ctm360-hv-incident-list
Get the list of incidents from HV.
ctm360-hv-incident-status-change
Change status of a HV incident and optionally add a comment.
get-mapping-fields
Returns the list of fields for an incident type.
get-modified-remote-data
Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.
get-remote-data
Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
update-remote-system
Updates the remote system with local changes.

Source

HackerView.py HackerView_test.py HackerView.yml HackerView_description.md command_examples.txt

Download History Raw

name: CTM360_HackerView
display: CTM360 HackerView
category: Network Security
provider: CTM360
commonfields:
  id: CTM360_HackerView
  version: -1
configuration:
- additionalinfo: "Choose the direction to mirror the incident: Incoming (from HackerView to Cortex XSOAR), Outgoing (from Cortex XSOAR to HackerView), or Incoming and Outgoing (from/to Cortex XSOAR and HackerView)."
  defaultvalue: Incoming And Outgoing
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  hidden:
  - marketplacev2
  - platform
  required: false
  section: Collect
- defaultvalue: Light Scan
  display: Module To Use
  additionalinfo: "The module to use: Light Scan or Deep Scan."
  name: module_to_use
  required: false
  type: 15
  options:
  - Light Scan
  - Deep Scan
  section: Collect
- additionalinfo: The time the incidents should be fetched starting from.
  name: first_fetch
  required: false
  type: 0
  defaultvalue: 7 days
  display: First fetch (<number> <time unit>, e.g., 12 hours)
  section: Collect
  advanced: true
- name: api_key
  type: 9
  required: true
  additionalinfo: The CTM360 HackerView API Key to use for fetching data.
  section: Connect
  displaypassword: API Key
  hiddenusername: true
- display: Maximum Number of Incidents per Fetch
  name: max_fetch
  type: 0
  required: true
  section: Collect
  defaultvalue: "25"
  additionalinfo: The maximum number of incidents to fetch per run. Maximum is 200.
  advanced: true
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
  advanced: true
- display: Incident type
  defaultvalue: HackerView Incident
  name: incidentType
  type: 13
  required: false
  section: Connect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
defaultmapperin: 'CTM360-HackerView - Incoming Mapper'
description: 'External Attack Surface Management platform, which combines automated asset discovery, issue identification / management, remediation guidelines, security ratings and third party risk management.'
script:
  commands:
  - name: ctm360-hv-incident-list
    description: Get the list of incidents from HV.
    arguments:
    - description: Select "From" date to fetch incidents starting from it.
      name: dateFrom
      required: false
    - description: Select "To" date to fetch incidents up to it.
      name: dateTo
      required: false
    - description: Set number of results to fetch.
      name: maxHits
      required: false
    - description: Set the order of the results.
      name: order
      required: false
    outputs:
    - contextPath: HackerView.IncidentList
      description: List of all HV incidents.
  - name: ctm360-hv-incident-status-change
    description: Change status of a HV incident and optionally add a comment.
    arguments:
    - name: ticketId
      description: '"ID" of the incident to change status.'
      required: true
    - name: ticketStatus
      description: 'New "Status" of incident.'
      required: true
    - name: comment
      description: '"Comment" to accompany the status change (Optional).'
      required: false
  - name: get-mapping-fields
    description: Returns the list of fields for an incident type.
    arguments: []
  - name: ctm360-hv-incident-details
    description: Fetch details of a single incident from the HackerView platform.
    arguments:
    - description: '"Ticket ID" of the incident to fetch.'
      name: ticketId
      required: true
    outputs:
    - contextPath: HackerView.RemoteIncident.id
      description: The symbolic incident ID.
    - contextPath: HackerView.RemoteIncident.timestamp
      description: The database timestamp.
    - contextPath: HackerView.RemoteIncident.confidence
      description: The confidence of the report.
    - contextPath: HackerView.RemoteIncident.cve_id
      description: The associated CVE identifier(s).
    - contextPath: HackerView.RemoteIncident.cwe
      description: The list of associated CWEs.
    - contextPath: HackerView.RemoteIncident.issue_category
      description: The category of the incident.
    - contextPath: HackerView.RemoteIncident.issue_name
      description: The name of the incident.
    - contextPath: HackerView.RemoteIncident.potential_attack_type
      description: The potential attack type that can make use of the incident.
    - contextPath: HackerView.RemoteIncident.potential_impact
      description: The potential impact of the incident.
    - contextPath: HackerView.RemoteIncident.status
      description: The active status of the incident.
    - contextPath: HackerView.RemoteIncident.progress_status
      description: The progress of incident response.
    - contextPath: HackerView.RemoteIncident.severity
      description: The severity of the incident.
    - contextPath: HackerView.RemoteIncident.resolved_ip
      description: The IP resolved on the affected asset.
    - contextPath: HackerView.RemoteIncident.first_seen
      description: The incident creation date.
    - contextPath: HackerView.RemoteIncident.last_seen
      description: The last discovery date for the incident.
    - contextPath: HackerView.RemoteIncident.last_updated
      description: The last update date for the incident.
    - contextPath: HackerView.RemoteIncident.environments
      description: The environments associated with the incident.
    - contextPath: HackerView.RemoteIncident.ticket_id
      description: The ticket ID.
    - contextPath: HackerView.RemoteIncident.technologies
      description: The technologies on the affected asset.
    - contextPath: HackerView.RemoteIncident.domain
      description: The domain of the affected asset.
    - contextPath: HackerView.RemoteIncident.host
      description: The host of the affected asset.
    - contextPath: HackerView.RemoteIncident.asset_type
      description: The affected asset type.
    - contextPath: HackerView.RemoteIncident.asset
      description: The affected asset.
    - contextPath: HackerView.RemoteIncident.brand
      description: The organization brand the incident belongs to.
    - contextPath: HackerView.RemoteIncident.ip
      description: The IP address associated with the finding.
    - contextPath: HackerView.RemoteIncident.port
      description: The network port associated with the finding.
    - contextPath: HackerView.RemoteIncident.uri
      description: The URI path or resource related to the finding.
    - contextPath: HackerView.RemoteIncident.url
      description: The base URL of the affected asset or service.
    - contextPath: HackerView.RemoteIncident.issue_type
      description: The type or classification of the issue.
    - contextPath: HackerView.RemoteIncident.issue_description
      description: The detailed description of the issue.
    - contextPath: HackerView.RemoteIncident.cpe
      description: The Common Platform Enumeration (CPE) identifier if applicable.
    - contextPath: HackerView.RemoteIncident.cvss_metrics
      description: The CVSS vector or metric string for the vulnerability.
    - contextPath: HackerView.RemoteIncident.cvss_score
      description: The CVSS base score for the vulnerability.
    - contextPath: HackerView.RemoteIncident.epss_score
      description: The Exploit Prediction Scoring System (EPSS) score.
    - contextPath: HackerView.RemoteIncident.known_exploited
      description: The indicator of whether the vulnerability is known to be exploited.
    - contextPath: HackerView.RemoteIncident.hackerview_link
      description: The link to the issue in the HackerView platform.
    - contextPath: HackerView.RemoteIncident.evidence
      description: The request/response evidence for the finding (e.g. request, response, curl_command).
  - name: get-remote-data
    arguments:
    - description: The incident ID.
      name: id
      required: true
    - description: Retrieves entries that were created after lastUpdate.
      name: lastUpdate
      required: true
    description: Gets remote data from a remote incident. This method does not update the current incident, and should be used for debugging purposes.
  - name: get-modified-remote-data
    arguments:
    - description: A date string in local time representing the last time the incident was updated. The incident is only returned if it was modified after the last update time.
      name: lastUpdate
      required: true
    description: Gets the list of incidents that were modified since the last update time. Note that this method is here for debugging purposes. The get-modified-remote-data command is used as part of a Mirroring feature, which is available in Cortex XSOAR from version 6.1.
  - name: update-remote-system
    arguments:
    - description: Remote ID of incident to update in the remote system.
      name: remoteId
      required: true
    description: Updates the remote system with local changes.
  isfetch: true
  runonce: false
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)
sectionorder:
- Connect
- Collect